Morato Antoine

**Name of the Vulnerable Software and Affected Versions** WPAdverts – Classifieds Plugin versions prior to 2.3.5 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the `adverts location` parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. **Recommendations** Update WPAdverts – Classifieds Plugin to version 2.3.5 or later. Avoid using the `adverts location` parameter until the plugin is updated.

**Name of the Vulnerable Software and Affected Versions** Real Estate Manager – Property Listing and Agent Management versions prior to 7.4 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This is achieved via the `first name` parameter. Additionally, the reCAPTCHA check can be bypassed by omitting the `g-recaptcha-response` parameter, as validation only occurs if the parameter is present. **Recommendations** Update the plugin to version 7.4 or later. As a temporary mitigation, restrict or sanitize inputs for the `first name` parameter.

**Name of the Vulnerable Software and Affected Versions** The Academy LMS WordPress plugin versions prior to 4.0.0 **Description** The plugin fails to verify course enrollment or object ownership when returning lesson content via a REST API route. This allows users with self-registerable student accounts to access the full content of arbitrary lessons, including those belonging to private or paid courses for which they are not enrolled. **Recommendations** Update The Academy LMS WordPress plugin to version 4.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** The Academy LMS WordPress plugin versions prior to 4.0.0 **Description** The plugin fails to verify if a quiz question belongs to a course that the requesting user is authorized to access before returning the answer options. This allows any authenticated user with access to at least one course, such as an enrolled student, to read the quiz answer options for questions in other courses to which they are not enrolled. **Recommendations** Update The Academy LMS WordPress plugin to version 4.0.0 or later.

Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

**Name of the Vulnerable Software and Affected Versions** Estatik Real Estate Plugin WordPress plugin versions prior to 4.3.5 **Description** Reflected Cross-Site Scripting occurs because the plugin fails to sanitize and escape several values decoded from a request parameter before reflecting them in an unauthenticated AJAX response. Cross-Site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update the plugin to version 4.3.5 or later.

**Name of the Vulnerable Software and Affected Versions** Easy Appointments versions prior to 4.0.2.2 **Description** The plugin fails to use an unguessable token to authorize appointment cancellation and confirmation actions via mail-links. The token is derived from a hardcoded source-embedded salt and the appointment's creation timestamp. Consequently, unauthenticated attackers who can determine or guess the timestamp can cancel or confirm arbitrary appointments. **Recommendations** Update to version 4.0.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Rox Appointment Booking versions prior to 1.2.0 **Description** The plugin fails to verify the order total or the selected payment method against server-side pricing during the booking creation process. This allows unauthenticated attackers to create confirmed bookings at an arbitrary price and bypass configured payment-method restrictions. **Recommendations** Update Rox Appointment Booking to version 1.2.0 or later.